Re: Use of AES as prf in IKEv2

[Uri Blumenthal <uri@bell-labs.com>]

Charlie,

I'm looking into this right now and would like a couple
of days - till SAAG meeting - to possibly make a proposal.
Out of hand, what you proposed looks OK.


Charlie_Kaufman@notesdev.ibm.com wrote:
> Having seen the alternatives, I withdraw my earlier objection to Hugo's
> proposal for dealing with prf functions with fixed length keys. His
> recommendation was that if the prf takes a fixed length key, we take the
> first bits of the initiator's nonce as the first half and the first bits of
> the responder's nonce as the second half. Not part of his suggestion, but
> to make the proposal fully specified in all cases, I'd add that if either
> nonce is shorter than half the fixed length key that it be padded with zero
> bits.
> 
> Does anyone object?
> 
>           --Charlie
> 
> Opinions expressed may not even be mine by the time you read them, and
> certainly don't reflect those of any other entity (legal or otherwise).
>